The vulnerability CVE-2025-23708 affects the DF Draggable JavaScript library by Dominic Fallows, specifically versions up to 1.13.2. It is a Cross-Site Request Forgery (CSRF) issue that enables stored Cross-Site Scripting (XSS) attacks. This means that an attacker can trick a user into submitting unauthorized requests that result in malicious scripts being stored and executed in the context of the affected application. The CVSS 3.1 base score of 7.1 reflects a network attack vector with low attack complexity, no privileges required, but requiring user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to stored XSS, which may allow attackers to execute arbitrary scripts in the context of the affected application, potentially compromising user data and session integrity. The CSRF aspect means that attackers can induce users to perform unwanted actions without their consent. The combined impact affects confidentiality, integrity, and availability to a limited extent as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider implementing CSRF protections such as anti-CSRF tokens and input validation to mitigate risk. Avoid using vulnerable versions of DF Draggable if possible.